1. Home
  2. CVE Database
  3. CVE-2024-52299
HIGH · 7.5

CVE-2024-52299

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to pre...

Vulnerability Description

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
XwikiPdf Viewer Macro< 2.5.6

Related Weaknesses (CWE)

CWE-340

References

FAQ

What is CVE-2024-52299?

CVE-2024-52299 is a vulnerability with a CVSS score of 7.5 (HIGH). macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to pre...

How severe is CVE-2024-52299?

CVE-2024-52299 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-52299?

Check the references section above for vendor advisories and patch information. Affected products include: Xwiki Pdf Viewer Macro.